Profile manager spotlight message "com.apple.iTunesLibraryService"

Question

Hi
Before asking my question a quick overview of my computer environment:
I've a  Mac mini with OS X server (Mavericks) connected to a Windows Server 2003 Active Directory. I'm going to use some 40 iMac's on our school (combined with Windows computers).
On the Mac mini I'm using Profile manager to allow or deny some settings on the iMac's.
My environment uses the Dutch language - I try to translate as accurate as possible!
I only have settings installed on machine-level (not on user or group level).
Here are my settings for the use of Spotlight (in Profile manager):
Devicegroup IMACS > Dock > Apps in dock: Launchpad, Maps, Safari, iTunes (11.1.4)
Devicegroup IMACS > Restrictions > Preferences:all selected items are deactivated except Dock, Mission Control, Sound and Spotlight
Devicegroup IMACS > Restrictions > Apps:Allow apps: iTunes, Spotlight, ...
Devicegroup IMACS > Restrictions > Media:Access to disks: internal disks allowed, ...
When a (test)user enters some characters in Spotlight and then erases those characters a message pops up stating: "You don't have access to use the application com.apple.iTunesLibraryService". This happens every first time the user makes use of Spotlight.
Anyone a clue what's missing of what I forgetting to adjust?

Answer 1

So I potentially have the issue resolved. After a few minutes of cranking away at spotlight I have no error and have never had it take that long to pop up.
I opened console and when the error popped up stating “You do not have permission to use the application “com.apple.iTunesLibraryService.” in console this popped up:
com.apple.quicklook.sattelite:
[QL] Could not get ITLibrary: Error Domain=NSPOSIXErrorDomain Code=100001 “Could not load.” UserInfo=0x7fd480609040 {NSLocalizedDescription=Could not load., NSUnderlyingError= 0x7fd48040d1e0 “The operation couldn’t be completed. (OSstatus error 100005.)”}
So I looked around a bit and found these paths contain references to QuickLook:
/System/Library/Frameworks/
/System/Library/QuickLook/
/Library/
~/Library/
I added all of those to the allowed folder list and so far that error has not popped up again. I added the /System/Library/QuickLook/ folder explicitly as opposed to just /System/Library/ as I do not want kids using screen sharing (cheating issue) or the jar launcher (minecrafting in class)
For reference I am on 10.9.4 using Profile Manager, payloads are managed with in a machine group. The folders mentioned above were added to the Allow Folders section of Apps under Restrictions. Hope this helps someone else. YMMV so far it appears to have worked. I'll update if it breaks again.